Responsivefilemanager
Monthly
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.